[melky]

Угу, кстати тоже самое касается подгружаемых модулей, даже в доке по NPM про это написано.

да ну нафиг, папка node_modules 200 мб весит)

https://docs.npmjs.com/all

Should I check my node_modules folder into git?

Usually, no. Allow npm to resolve dependencies for your packages.

For packages you deploy, such as websites and apps, you should use npm shrinkwrap to lock down your full dependency tree:

https://docs.npmjs.com/cli/shrinkwrap

If you are paranoid about depending on the npm ecosystem, you should run a private npm mirror or a private cache.

If you want 100% confidence in being able to reproduce the specific bytes included in a deployment, you should use an additional mechanism that can verify contents rather than versions. For example, Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs.

точно. мне нужно заблокировать версии ВСЕХ зависимостей через

npm shrinkwrap

ну и при выгрузке скачивать их через

npm install --production